Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 2003 web server sitting behind a Cisco Pix 515 firewall. HTTP access is fine, but I can't make FTP access to work.

The configuration I'm trying:

fixup protocol ftp 20
static (inside,outside) <external-IP> <internal-IP> netmask 0 0
conduit permit tcp host <external-IP> eq www any
conduit permit tcp host <external-IP> eq ftp-data any
conduit permit tcp host <external-IP> eq ftp any

I also tried "fixup protocol ftp 21" and "no fixup protocol 20"; as they didn't work, I removed them.

It connects successfully, I type my username and password just fine. When I try any command I get:

C:\>ftp <server-name>
Connected to <server-name>.
220 Microsoft FTP Service
User (<server-name>:(none)): <username>
331 Password required for <username>.
230 User <username> logged in.
ftp> dir
500 Invalid PORT Command.
150 Opening ASCII mode data connection for /bin/ls.

And it sits there forever. I can see on eventvwr that the server drops the connection after the time-out I configured is reached.

If I try from Internet Explorer I get a message box:

200 Type set to A
500 Invalid PORT command
500 'LPRT 6,16,0,0,0,0,0,0,0,0,9,4,0,0,0,0,34,113,2,6,71': command not understood

FTP to this server from inside my LAN works fine.

Can anyone help me? Thanks a lot!

share|improve this question
What version of PIX firmware are you running 6,7 or 8? – Zypher Jul 15 '09 at 14:02
I'm using PIX Version 5.1(4) – Andre Luis Jul 15 '09 at 14:40
It would be a nice idea to upgrade it ! – radius Jul 15 '09 at 15:21
Do your pix logs show anything? fixup protocol ftp 21 should be all you need – Adam Jul 15 '09 at 15:23
Thank you radius! – Andre Luis Jul 15 '09 at 15:30


fixup protocol ftp 20

and just add:

fixup protocol ftp

without a port number. A port number is not needed. In addition to this, you may need to issue a clear xlate for it to take effect right away...however, this will disconnect any/all active connections (and can cause other issues).

Edited to add:

As Zephyr asked in comments above, it is important to know what version of PIX software you're running as Cisco replaced fixup with inspect.

share|improve this answer
He said : "I also tried "fixup protocol ftp 21" and "no fixup protocol 20"; as they didn't work, I removed them.". I made the same answer before reding the question a second time ;) – radius Jul 15 '09 at 14:14
But I also suspect that he did this and tried them right away before trying clear xlate. – GregD Jul 15 '09 at 14:17
When I try "fixup protocol ftp" it returns an error message: "usage: [no] fixup protocol <prot> <port>[-<port>]" – Andre Luis Jul 15 '09 at 14:41
I googled clear xlate and I don't think it is necessary because the command "static (inside,outside) <external-IP> <internal-IP> netmask 0 0" was already in place – Andre Luis Jul 15 '09 at 14:45
What does a "show fixup" return? – GregD Jul 15 '09 at 16:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.